Local oscillator fluctuation opens a loophole for Eve in practical continuous- variable 

quantum key distribution system 



m 
o 



in 



^ : 

Oh- 
£ 

cr 



> 
cn 
^- 
o 

cn 
o 



x 



Xiang-Chun Ma, 1 Shi-Hai Sun, 1 Mu-Sheng Jiang, 1 and Lin-Mei Liang 1 - 2 'Q 

'Department of Physics, National University of Defense Technology, Changsha 410073, P.R.China 
2 State Key Laboratory of High Performance Computing, 
National University of Defense Technology, Changsha 410073, P.R.China 

We consider the security of practical continuous-variable quantum key distribution implementa- 
tion with local oscillator (LO) fluctuating in time, which opens a loophole for Eve to intercept the 
secret key. We show that Eve can simulate this fluctuation to hide her Gaussian collective attack 
by reducing the intensity of LO. Numerical simulations demonstrate that, if Bob don't monitor LO 
intensity and scale his measurements with instantaneous intensity values of LO, the secret key rate 
will be compromised severely. 



PACS numbers: 03.67.Dd, 03.67.Hk, 89.70.Cf 



I. INTRODUCTION 

Continuous-variable quantum key distribution 
(CVQKD), as an unconditional secure communication 
scheme between two legitimate parties Alice and Bob, 
has achieved advanced improvements in theoretical 
analysis and experimental implementation in recent 
years 1-5]. Practical implementation systems, such as 
Fiber-based Gaussian-modulated and Discrete- 

modulated [H| coherent-state protocol QKD systems 
over tens of kilometers, have been demonstrated in a few 
groups. The unconditional security of such systems with 
prepare-and-measure (PM) implementation is confirmed 
by the security analysis of equivalent entanglement-based 
(EB) scheme [H-llJ. 

However, the traditional security analysis of EB 
scheme of CVQKD just includes signal beam, not in- 
cluding local oscillator (LO) which is an auxiliary light 
beam used as a reference to define the phase of the signal 
state and is necessary for balanced homodyne detection 
(BHD). This will leave some security loopholes for Eve 
because LO is also unfortunate within the Eve's manipu- 
lating domain. The necessity of monitoring LO intensity 
for the security proofs in discrete QKD protocols em- 
bedded in continuous variables has been discussed [l5j . 
Moreover, in [iff], the excess noise caused by imperfect 
subtraction of BHD in the presence of LO intensity fluc- 
tuations has been noted and quantified with formulation. 
However, in practical implementation of CVQKD, shot 
noise scaling with LO power measured before keys dis- 
tribution is still assumed to keep constant if the fluctua- 
tions of LO intensity are small. And in this circumstance 
pulses with large fluctuation are just discarded as shown 
in [l6| . Unfortunately, this will give Eve some advantages 
to explore the fluctuation of LO. 

In this paper, we primarily analyze the effect of this in- 
tensity fluctuation of LO on the secret key rate Alice and 



Bob hold. To begin the analysis, we first describe Bob's 
measurements under the fluctuation of LO intensity, and 
propose an attacking scheme exploring this fluctuation. 
We consider the security of practical CVQKD implemen- 
tation under this attack and calculate the secret key rate 
with and without Bob monitoring LO for reverse and 
direct reconciliation protocol. We find that the fluctu- 
ation of LO could compromise the secret keys severely 
if Bob don't scale his measurements with instantaneous 
intensity values of LO. Finally, we briefly discuss the ac- 
curate monitoring of LO intensity to confirm the security 
of practical implementation of CVQKD. 



II. LOCAL OSCILLATOR INTENSITY 
FLUCTUATION AND ATTACK 

Generally, in practical system of CVQKD, the local os- 
cillator intensity is always monitored by splitting a small 
part with a beam splitter and pulses with large inten- 
sity fluctuation of LO are discarded too. However, even 
monitoring, we aren't clear about how the fluctuation, 
in particular the small fluctuation, affects the secret key 
rate yet. In order to confirm the secret key rate obtained 
by Alice and Bob being unconditional secure, in what 
follows, we will analyze the effects of this fluctuation on 
secret key rate only, and don't consider the imperfect 
measurement of BHD due to incomplete subtraction of it 
in presence of LO intensity fluctuations, which has been 
discussed in fl6| . 

Ideally, with strong LO, a perfect BHD measuring a 
weak signal whose quadratures are Xs & {Qs,Ps} will 



output the results 



i qu i 
.17], 



X9 = k\aia\{Q ln cos6» + P m sinf 



(1) 



where k is a proportional constant of BHD, aro is am- 
plitude of LO, is the relative phase between signal and 
LO except signal's initial modulation phase. So scaling 
with LO power or shot noise, the results can be recast as 



'Electronic address: nmliang@nudt.edu.cn 



Xq = X in — Xs + Xn, 



(2) 
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with 9 in Eq. (Q} is or tt/2. Here the quadratures Q and 
P are defined as X in G {Q in ,P in } and X N G {Qn,Pn}, 
where Xn is the quadrature of vacuum state. 

However, in practical system, the intensity of LO fluc- 
tuates in time. With a proportional coefficient -q > 0, 
practical LO intensity can be described as \a' IX) \ 2 — 
ii\ollo\ 2 , where olld is the initial amplitude of LO used 
by normalization. If we don't monitor LO or quantify its 
fluctuation, especially just let the outputs of BHD scale 
with the initial intensity or power of LO, the outputs 
then read 



X Q = ^jX . 



(3) 



Unfortunately, this fluctuation will open a loophole for 
Eve, as we will see in the following sections. 

In conventional security analysis, like EB scheme 
equivalent to usual PM implementation depicted in 
Fig-UJa), LO is not taken into consideration and its inten- 
sity is assumed to keep unchanged. However, in practical 
implementation, Eve not only intercept the signal beam 
but also LO and she can replace the quantum channel 
between Alice and Bob with her own perfect quantum 
channel as shown in Fig.QJb) and (c). In so doing, Eve's 
attack can be partially hidden by reducing the inten- 
sity of LO with an attenuator simulating the fluctuation 
without changing LO's phase, and such attack can be 
called LO intensity attack (LOIA). In following analysis, 
we will see that, in parameter estimation between Al- 
ice and Bob, channel excess noise introduced by Eve can 
be reduced arbitrarily, even to be null, with Eve just by 
tuning the transmission of LO. Consequently, Alice and 
Bob would underestimate Eve's intercepted information 
and Eve could get partial secret keys Alice and Bob hold 
without being found under this attack. 

Fig. Hfb) describes the LOIA, which consists in at- 
tacking the signal beam with general Gaussian collective 
attack |I2hI4| and attacking LO beam with intensity at- 
tenuation by a no changing phase attenuator A, such as a 
beam splitter whose transmission is variable. This signal 
beam Gaussian collective attack consists of three steps: 
Eve interacts her ancilla modes with the signal mode by a 
unitary operation U for each pulse and store them in her 
quantum memory, then she make an optimal collective 
measurement after Alice and Bob's classical communi- 
cation. Fig. [TJc) is one practical LOIA with U being 
a beam splitter transformation. Its signal attack is also 
called entangling doner attack, which is presented first 
by Grosshan [l8| and improved by Weedbrook [l9|, [2(| ■ 
We will give a demonstration that with this entangling 
doner Eve can get the same amount of information as 
much as the one Fig. HJb) shows in appendix A. 



III. ESTIMATION OF SECRET KEY RATE 
UNDER LOIA 

We analyze a practical CVQKD system with homo- 
dyne protocol for example to demonstrate the effect of 




FIG. 1: (a) EB scheme, based on Alice heterodyning one 
of the mode of Einstein-Podolsky-Rosen(EPR)[23j state and 
Bob homodyning the other half, with Eve only attacking the 
signal, (b) LOIA consisting in attacking the signal beam with 
general Gaussian collective attack and attacking LO with in- 
tensity attenuation by a no changing phase attenuator A such 
as a beam splitter whose transmission is variable. U is uni- 
tary operation and Xe is Eve's intercepted mode, (c) LOIA 
with U being a beam splitter transformation and Eve's an- 
cilla modes Xeo and Xe2 being the EPR pairs with variance 
N, Xei intercepted mode. This signal attack is also called 
entangling doner attack. 



LOIA on secret key rate, and for simplicity we don't 
give the results of heterodyne protocol which is analo- 
gous with homodyne protocol. In usual PM implementa- 
tion, Alice prepares a series of coherent states centered on 
Xs G {Qs: Ps} with each pulse, Qs, Ps respectively sat- 
isfy a Gaussian distribution independently with the same 
variance Vs and zero mean, and she then send them to 
Bob through a quantum channel which might be inter- 
cepted by Eve. This initial mode prepared by Alice can 
be described as Xa = X$ + Xn, and Xa G {Qa,Pa} 
is the quadrature variable. Here Xn G {Qn,Pn} de- 
scribes the quadratures of vacuum mode. Note that we 
denote an operator with a hat, while without a hat the 
same variable corresponds to the classical variable after 
measurement. So the overall variance of initial mode pre- 
pared by Alice is V = Vs + 1. When this mode comes to 
Bob, Bob will get a mode Xb G {Qb, Pb}, 



X B = VTXa + Vl - TE, 



(4) 



where E describes Eve's mode introduced through the 
quantum channel whose quadrature variance is N. Bob 
randomly selects a quadrature to measure, and if Eve 
attenuates the intensity of LO, but Bob's outputs still 
scale with the initial LO intensity, just like Eq. ([3]) he 
will get the measurement 

xg = ^jx B = ^j(VTx A + VT^TE) , (5) 

where Xb is G K (or equivalently Pb G K). However, 
if Bob monitors LO and also scales with the instanta- 
neous intensity value of LO with each pulse, he will get 
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Xb without any loss of course. Note that in this pa- 
per we just talk about an optimal measure and the ef- 
ficiency and other imperfections of Bob's BHD are not 
considered. Thus the variance of Bob's measurements 
and conditional variance on Alice's encodings with and 
without monitoring (in what follows, without monitoring 
specially indicates that Bob's measurement is obtained 
just by scaling with initial LO intensity instead of moni- 
toring instantaneous value, and vice versa) can be given, 
respectively, by 



V B = TV + (1 - T)N , 
Vg 1 =r}[TV + (l-T)N] 
V b \a =T+(1-T)N, 
VS\ A =V[T + (1-T)N] , 



(6) 
(7) 
(8) 
(9) 



where all variances are in shot noise units and the con- 
ditional variance is defined asl2ll |22| 



V X \ Y = V{X) - 



(XY)\ 
V(Y) 



(10) 



Hence, the covariance matrix of Alice's and Bob's 
mode can be obtained as 



jab(V,T, N) 



1A <JAB 
K °AB IB 

VI y/T(V 2 - l)a z 



lAB = 



sjT{V 2 - l)a z {TV + (1 - T)N) ■ I 

( VI VvT(V 2 - Vja z 

WvT(V 2 - l)a z rj [TV + (1 - T)N] I 



(11) 



(12) 



where c z = ( o -i ) i s Pauli matrix and I is unit matrix. 

From Eq. ([6]) and (0 we can derive that the channel 
transmission and excess noise are T,e= (1—T)(N—1)/T 
with monitoring, and r]T, e m — e— — 1) without mon- 
itoring, respectively. Hence, by attenuating LO intensity 
as Fig. [1] shows to make < r\ < 1, Eve could arbi- 
trarily reduce e m to zero, thus she will get the largest 
amount of information permitted by physics. In fol- 
lowing numerical simulation we always make e m = 0, 
namely, r)(l — T)N = 1 — i]T. Thus, the covariance ma- 
trix 7™ B = "{ab{V, r/T, 1) and Eve's introducing noise N 
(in entangling doner it is Eve's EPR state's variance as 
Fig- Hie) shows) should be selected to be 



N : 



1 — T]T 

V0--TY 



(13) 



In order to estimate the secret key rate, without loss of 
generality, we first analyze the reverse reconciliation then 
consider the direct reconciliation. 



A. Reverse reconciliation 

From Alice and Bob's points of view, the secret key 
rate for reverse reconciliation with monitoring or not are 



given, respectively, by 



Krr — Iab — Xbe, 

^■RB — 1 AB XBE' 



(14) 
(15) 



where the mutual information between Alice and Bob 
with and without monitoring are the same, and that's 

11/1 V m 
Iab = t; log ^- = - log ^- = ■ (16) 



- Vb\a 2 



V, 



B\A 



This is because Bob's measurements in these two cases 
are just different with a coefficient 77, and they corre- 
spond with each other one by one, so t hey are equivalent 
according to data processing theorem [24l. 25]. However, 
the mutual information between Eve and Bob given by 
Holevo bound[26| in these two cases are not identical. 
As the previous analysis showed, in Bob's point of view, 
channel transmission and the excess noise estimation are 
different. But from Eve's point of view, they are iden- 
tical according to data processing theorem because she 
estimates Bob's measurements in these two cases just 
multiplying a coefficient 77. We'll calculate the practi- 
cal information intercepted by Eve first. It can be given 
by 



Xbe = S(E) - S(E\B), 



(17) 



where S(-) is the Von Neumann entropy 27]. For a Gaus- 
sian state g, this entropy can be calculated by the sym- 
plectic eigenvalues of the covariance matrix 7 characteriz- 
ing g. To calculate Eve's information, first, Eve's system 
E can purify AB permitted by quantum physics, so that 
S(E) — S(AB). Second, after Bob's projective measure- 
ment, the system AE is pure, so that S(E\B) = S(A\B). 
Designating a = V, b = TV + (1 - T) N, c = ^T{V 2 - 1), 
the symplectic eigenvalues of jab are given by 



Ai, 



IAtYA 2 -4B 2 



(18) 



wher e A = a 2 + b 2 — 2c 2 and B = ab — c 2 . Similarly, the 
entropy S(A\B) is determined by the symplectic eigen- 
value A3 of covariance matrix 7^ [29| , namely, 

li B = 7A - ^ B (X lB X) MP a A B, (19) 



where X 



_ ( 1 (P 



and MP stands for the Moore Penrose 



inverse of a matrix. Then A3 = J ^tv+Iv-t)!^ > * nc 
Holevo bound reads 

Xbe(V,T,N) = G(^l) + G(^l) G(^l), 

(20) 

where G(x) = {x + 1) log 2 (a; + 1) — x\og 2 x. However, 
Eve's information estimated by Bob without monitoring 
is given by 



XB E =XBE(V,r)T,l) 



(21) 
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Substituting Eq. (20J and J2TJ) into Eq. and (|T5j) 

respectively, the secret key rate with and without Bob's 
monitoring can be obtained. However, the secret key rate 
in Eq. (jl5[) without monitoring is unsecure in evidence. 
Eve intercepted partial information from K RR but not 
be found, in other words, Alice and Bob underestimate 
Eve's information but without realizing it. Actually, the 
practical or unconditional secure secret key rate K RR , 
which we called truly secret key rate, should be available 

by replacing Xbe in E( l- C03> with E q- ©• Note that it; 
is identical with the monitoring secret key rate in Eq. (|14[) 
due to Eq. ([TBI 

We investigate the secret key rate K RR Bob measured 
without monitoring and the truly one or equivalently 
monitoring one K RR for reverse reconciliation under Eve 
attacking the intensity of LO. As Fig. [2]shows, with var- 
ious values of transmission of LO that can be controlled 
by Eve, the truly secret key rate Alice and Bob actu- 
ally share decreases rapidly over long distances or small 
channel transmission. 




0.2 0.4 0.6 0.8 

Channel Transmission T 



FIG. 2: (Color online) Reverse reconciliation pseudo-secret 
key rate and truly one vs. channel transmission T under 
LOIA. Solid lines are secret key rate estimated by Bob with- 
out monitoring LO intensity and dashed lines are the truly 
ones. Color 'red', 'green', 'blue', 'cyan', 'magenta' corre- 
sponds to the LO transmission r\ — 0.8,0.85,0.9,0.95,1, re- 
spectively. Here Alice's modulation variance Vs = 20. 



Additionally, because the mutual information between 
Alice and Bob with and without monitoring are identical 
as Eq. (jTB|) shows, subtracting Eq. (fT4")l from Eq. (fT5)) we 
can estimate Eve's intercepted information (K RR — K RR ) 
which is plotted in Fig. [3] We find that Eve could get 
partial or full secret keys which Alice and Bob hold by 
controlling the different transmission of LO. Taking 20km 
transmission distance for example, surprisingly, just with 
LO intensity fluctuation or attenuating rate 0.08, Eve is 
able to obtain the full secret keys for reverse reconcilia- 
tion without Bob's monitoring LO. 
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FIG. 3: (Color online) Reverse reconciliation pseudo-secret 
key rate (dashed lines) and intercepted one (solid lines) by 
Eve without being found vs. LO intensity fluctuation rate 
(1 — rf) with different transmission distances. From top to 
bottom the transmission distances are 10km, 20km, 30km, 
40km, and 50km, respectively. Inset is amplified one with 
(1 — rf) between ~ 0.16. Here Alice's modulation variance 
V s = 20. 



B. Direct reconciliation 

We now calculate the secret key rate for direct reconcil- 
iation, which is a little more complicated, and investigate 
the effect of LO intensity attack by Eve on CVQKD. The 
secret key rate estimated by Bob with and without LO 
monitoring is given, respectively, by 



Kdr = Iab — Xae, 



K 



DR 



AB 



Xae- 



(22) 
(23) 



Note that we have already calculated Iab and I™ B 
in Eq. ([ToT) and they are identical for direct and reverse 
reconciliation. For Eve we have 



Xae = S(E) - S(E\A), 



(24) 



where S(E) = S(AB) has been already computed in pre- 
vious section, and S(E\A) = S{BC\A) using the fact that 
after Alice's projective measurement on mode Aq and Co 
obtaining Qa in EB scheme shown in Fig. 03a), the sys- 
tem BCE is pure. To calculate S(BC\A), we have to 
compute the symplectic eigenvalues of covariance matrix 

7bc' which is obtained by 

iBC = 1BC - 0^ CA CK.^ A X) MF '(JBCA, (25) 

where jbc and <Jbca can be read in the decomposition 
of the matrix 



1BCA 



= ( IBC (? T BCA 
\&BCA 7 A 



(26) 
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which is available by elementary transformation of matrix 
(see Fig. IHa)) H HI 

Iacb = {S^ Co © I s ) T 1a oCo b (Sl s Co 8 I B ) , (27) 

where Ib is unit matrix. It is obtained by applying ho- 
modyning over mode A after mixing Aq and Co with a 
balanced beam splitter transformations'^^). The ma- 
trix jaoCqB = 1a b © lc and ~f Ao B actually is 7,4s in 
Eq. 7c is unit matrix. So we can get 



Ibc 



-c/>/2 



/6-c 2 /(a + l) y^c/(a + l) 
6 

y/2c/(a + l) 2a/(a+l) 

-c/V2 (a + l)/2/ 

(28) 

and the symplectic eigenvalues of it 



V 



'Ct VC 2 -4D 



M,5 



(29) 



where C = Q+b g+ A and D = B(b + B) . The Holevo bound 
then reads 
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FIG. 4: (Color online)Direct reconciliation pseudo-secret key 
rate and truly one vs. channel transmission T under LOIA. 
Solid lines are secret key rate estimated by Bob without moni- 
toring LO intensity and dashed lines are the truly ones. Color 
'red', 'green', 'blue', 'cyan', 'magenta' corresponds to the LO 
transmission r\ = 0.6, 0.7, 0.8, 0.9, 1, respectively. Here Alice's 
modulation variance Vs = 20. 



XAE (V,T,N) = J2G(^) -J2G(^), (30) 

i=l 3=4 

XAE=XA E (V,r 1 T,l). (31) 

Substituting Eq. ([H]) and j3IJ into Eq. (22) and (J2J) 

respectively, the secret key rates in these two cases are 
obtained. We plotted them for channel transmission T 
with various values of rj and find that the difference be- 
tween pseudo-secret key rate with Bob not monitoring 
LO and the truly one is still increasing with the channel 
transmission T becoming smaller. 

For Eve, when Bob don't monitor LO, she will get the 
partial or total secret key rate (Kp R — Kdr) without 
being found by subtracting Eq. (|2"2"j) from Eq. (|2"3")l when 
she reduces the intensity of LO. In Fig. [SJ we plotted 
pseudo-secret key rate for direct reconciliation and the 
mutual information overestimated by Alice and Bob. We 
find that for short distance communication (less 15km or 
3dB limit), a small fluctuation of LO intensity could still 
hide Eve's attack partially or totally. 



IV. DISCUSSION AND CONCLUSION 



0.8 




Local Oscillator Intensity Fluctuation Rate 1 -n 

FIG. 5: (Color online)Direct reconciliation pseudo-secret key 
rate (dashed lines) and intercepted one (solid lines) by Eve 
without being found vs. LO intensity fluctuation rate (1 — rf) 
with different transmission distances. From top to bottom the 
transmission distances are 6km, 8km, 10km, 12km, and 14km, 
respectively. Here Alice's modulation variance Vs = 20. 



With the analysis from the previous section, we show 
that reverse reconciliation is more sensible than direct 
reconciliation about the fluctuation of LO intensity and 
even with a small fluctuation or attenuation of LO inten- 
sity, Eve can get full secret keys, but not being found, 
that Alice and Bob hold. This is consistent with that 
channel excess noise has more severe impact on reverse 
reconciliation than direct reconciliation. Remarkably, 



LO intensity fluctuation opens a loophole for Eve, espe- 
cially in case of communication with low channel trans- 
mission or over long distance. Consequently, in practical 
implementation of CVQKD, we must monitor the LO 
fluctuation carefully and in particular scale the measure- 
ments with instantaneous intensity values of LO. How- 
ever, for reverse reconciliation communication over long 
distance, very small fluctuation of LO might compromise 
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the secret key rate completely, which presents a big chal- 
lenge for accurately monitoring LO intensity. 

Finally, we point out that in this paper we don't con- 
sider the imperfection of BHD such as detection efficiency 
and incomplete subtraction etc, which may make LO in- 
tensity fluctuation have more severe impact on estima- 
tion of secret key rate for Alice and Bob. 

In conclusion, we have analyzed the effect of LO in- 
tensity fluctuation on secret key rate estimation of Alice 
and Bob for reverse and direct reconciliation. Incredibly, 
Bob's estimation of secret key rate will be compromised 
severely without monitoring LO or his measurements not 
scaling with LO instantaneous intensity values even with 
monitoring but just discard large fluctuation pulse like 
in(l6j. Furthermore, we have shown that Eve could hide 
her attack partially by reducing the intensity of LO and 
even could steal the total secret keys Alice and Bob share 
without being found by a small attenuation of LO inten- 
sity, especially for reverse reconciliation. Finally, we have 
also briefly discussed the monitoring of LO and pointed 
out that it would be a challenge for high accurately mon- 
itoring. 



and the conditional variance Ve 1 \a can be calculated as, 
using Eq. ([TO]), 



V EllA = (l-T) + TN. (A3) 
Hence, Eve's covariance matrix can be obtained as 



r* (VV\-f 7£ i cr E 1 E 2 \-f dia 9{VE 1 ,V El ) Z El E 2 <T; 

^ E[V,V) ~\ct EiE2 lE2 )-\ Z ElE2 a z Nl 

(A4) 

where Z ElEl — y/T(N 2 — 1) and the notation diag{, ) 
stands for a matrix with the arguments on the diago- 
nal elements and zeros everywhere else. The symplectic 
eigenvalues of this covariance matrix are given by 



Al,2 — 



'a=f VA 2 -4l> 



(A5) 



where A = V Ei + N 2 — 2Z 2 iE2 ,D = (V El N - Z% iE J> . 
Hence, the Von Neumann entropy of Eve's state is given 
by 

S(E) = G(^)+G(^±), (A6) 
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Appendix A: Security estimation by Entangling 
Cloner under LOIA 



In this appendix, we calculate the Holevo bound ob- 
tained by Eve for direct and reverse reconciliation using 
Weedbrook's entangling cloner modelfl^, |2(j, and then 
give the secret key rate shared by Alice and Bob under 
LOIA. We begin the analysis by calculating the Von Neu- 
mann entropy of Eve's intercepting state first. 

As Fig. [ljc) shows, the entangling cloner consists in 
Eve replacing the Gaussian quantum channel between 
Alice and Bob with a beam splitter of transmission T 
and an EPR pair of variance N. Half of the EPR pair 
mode Eq is mixed with Alice's mode in the beam splitter 
and is sent to Bob to match the noise of the real channel 
by tuning N. The other half mode Ei is kept by Eve 
to reduce the uncertainty on one output of the beam 
splitter, the mode E\ which can be read as 



X 



-VT^tx a + VTx Eo , 



(Al) 



where X Eo is the quadrature of mode Eq. Thus, the 
variance of mode E\ is given by 



V El = (1 - T)V + TN, 



(A2) 



1. Direct reconciliation 

For direct reconciliation protocol of CVQKD, the 
Holevo bound between Eve and Alice is given by Eq. (|24l) , 
where S(E) has been calculated by Eq. (fA"6"j) . S{E\A) 
can be obtained by the conditional covariance matrix 



7§ a =7e(V = 1,V), 
and its symplectic eigenvalues are given by 



(A7) 



(A8) 



2 

wher e A = V EM V El + N 2 - 2Z 2 EiE . 2 ,B = (V EM N - 
^e 1 e 2 )(^ / 'e 1 N — Z E E ). Thus, the conditional entropy is 



S(E\A) = G 



A, 



1, 



A 4 - L 



(A9) 



Substituting Eq. ([A6j) and (|A"9j) into Eq. ([24]), we can get 
the mutual information between Alice and Eve, 



X ae{V,T,N) = S{E)-S{E\A). 



(A10) 



Under LOIA, Bob's estimation of the Holevo bound 
without monitoring LO intensity then reads, using 
Eq. (jAT0|) 



Xae=Xae(V iV T,1). 



(All) 



With Eq. (fATO)) and (fATTl) . the secret key rate in Eq. ((22)) 
and (|23|) then can be calculated respectively, and numer- 
ically calculation demonstrates that they are consistent 
with the Fig. 0] perfectly. 
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2. Reverse reconciliation 

The calculation of Holevo bound between Eve and Bob 
for reverse reconciliation is a bit more complicated. Us- 
ing Eq. (fTTl) . we only need to calculate the conditional 
entropy S(E\B), which is determined by the symplectic 

eigenvalues A4 5 of covariance matrix 7^ B , 

1e B =1E- <jl lE2B (^ lB X) MP a ElE2B , (A12) 



wher e (j Ei e 2 b = [\X El X B J I, (X E2 X B J o z 
(Z EiB I,Ze 2 b<t z ) and Z ElB = y/T(l-T)(N - 
V),Z EriB = VT - T^N 2 - 1. Then, 7 f B can be recast 
as 



,x B (F HT 
lE ~\H G 



(A12') 



where F=diag(V E --^, V El ), G=diag(N~^, 

N), and H=diag(Z ElE2 - Z ^ B ^ B ; -Z ElE2 ). Hence, 
its symplectic eigenvalues are given by 



^5,6 — 



! Ct VC2-4D' 



where C = det(F) + det{G) + 2det(H),D' = dei( 7 f B ) 
and det(-) is the determinant of a matrix. So, we get the 
conditional entropy 

S(E\B) = G(^)+G(^), (A14) 
and then the Holevo bound 

X be(V, T, N) = S(E) - S(E\B). (A15) 

Consequently, without monitoring LO intensity, Alice 
and Bob will give Eve the Holevo bound 



Xbe = Xbe(V, V T,1) 



(A16) 



(A13) 



Substituting Eq. (|A"i~5l) and (|A16|) into Eq. ([14]) and (fT5|> 

respectively, the secret key rate with and without Bob's 
monitoring can be obtained, and for channel transmission 
T with various values of 77, they are numerically demon- 
strated to be consistent with Fig. [2] perfectly, too. 

Hence, it again indirectly confirm that either for di- 
rect or reverse reconciliation, the entangling doner could 
reach the Holevo bound against the optimal Gaussian 
collective attack. 
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